VULNERABILITY INTELLIGENCE

CVE-2023-0477

CVSS score8.8 HIGH
EPSS probability1.65%
CISA KEVNot currently listed
Published2023-03-13
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary files, such as PHP files. This is caused by incorrect file extension validation.

Weakness classification

  • CWE-434: Unrestricted Upload of File with Dangerous Type

Primary references